Git分支模型与Code Review流水线：支撑200人团队的协作架构

- Git版本：2.39.2（服务器端） / 2.43.0（本地）
- 代码托管：GitHub Enterprise Cloud（2024年2月版本）
- CI/CD：GitHub Actions（使用ubuntu-latest runner）
- 部署平台：Kubernetes v1.28 + ArgoCD 2.10
- 关键插件：git-flow-avh 1.12.3（用于命令行辅助）
- 代码规模：主仓库约300万行，1200+活跃分支（迁移前）

主分支：main（受保护，不可直接push）
开发分支：develop（受保护，所有feature合并到这里）
功能分支：feature/{ticket-id}-{description}
发布分支：release/{version}（从develop拉出，只修bug）
热修分支：hotfix/{version}-{ticket-id}（从main拉出）

# 对main和develop启用相同保护
for branch in main develop; do
  gh api repos/{org}/{repo}/branches/$branch/protection \
    --method PUT \
    --field required_status_checks[strict]=true \
    --field required_status_checks[contexts][]=ci/build \
    --field required_status_checks[contexts][]=ci/test \
    --field required_status_checks[contexts][]=code-review/diff-size \
    --field enforce_admins=true \
    --field required_pull_request_reviews[required_approving_review_count]=2 \
    --field required_pull_request_reviews[dismiss_stale_reviews]=true \
    --field required_pull_request_reviews[require_code_owner_reviews]=true \
    --field restrictions[users][]=deploy-bot
done

# 全局默认所有者
* @platform-core

# 前端组件目录由前端团队负责
/src/web/** @frontend-team
/src/web/components/** @frontend-arch

# API定义文件必须由架构组review
/api/proto/** @architecture-team

# CI配置变更需要DevOps批准
/.github/workflows/** @devops-team

name: ci
on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches: [main, develop]

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            backend:
              - 'backend/**'
            frontend:
              - 'src/web/**'

  build:
    needs: detect-changes
    runs-on: ubuntu-latest
    strategy:
      matrix:
        component: [backend, frontend]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 需要完整历史用于diff检查
      - name: Cache dependencies
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.npm
          key: ${{ runner.os }}-build-${{ hashFiles('**/build.gradle', '**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-build-
      - name: Build & Test
        run: |
          if [ "${{ matrix.component }}" == "backend" ]; then
            cd backend && ./gradlew build -x integrationTest
          else
            cd src/web && npm ci && npm run build && npm test -- --coverage
          fi

# .github/actions/check-review-quality/action.yml
name: 'Check Review Quality'
description: 'Ensure PR has meaningful review artifacts'
inputs:
  min-approvals:
    description: 'Minimum number of approvals'
    default: '2'
  max-diff-size:
    description: 'Max lines changed before requiring senior review'
    default: '500'
runs:
  using: 'composite'
  steps:
    - name: Check diff size
      shell: bash
      run: |
        DIFF_SIZE=$(git diff origin/develop...HEAD --numstat | awk '{sum+=$1+$2} END {print sum}')
        echo "Diff size: $DIFF_SIZE lines"
        if [ "$DIFF_SIZE" -gt "${{ inputs.max-diff-size }}" ]; then
          echo "::error::Diff size $DIFF_SIZE exceeds limit. Requires review from tech lead."
          echo "required_reviewer=tech-lead" >> $GITHUB_ENV
          exit 1
        fi
    - name: Check comment density
      shell: bash
      run: |
        # 要求reviewer必须留下至少3条评论或1条实质性建议
        COMMENT_COUNT=$(gh pr view ${{ github.event.pull_request.number }} --json comments --jq '.comments | length')
        if [ "$COMMENT_COUNT" -lt 3 ]; then
          echo "::warning::Only $COMMENT_COUNT comments. Consider adding more detailed feedback."
        fi

git fetch origin develop
if [ $(git merge-base HEAD origin/develop) != $(git rev-parse origin/develop) ]; then
  echo "ERROR: Branch is behind develop. Please rebase."
  exit 1
fi